Hardware Sizing

Indications on process, memory and disk required are given below for networks with three different sizes.

Packets to Flow

The table below highlights the requirements for capturing packets and transforming them in flows.

	Small Network	Medium Network	Large Network	Very Large Network
Traffic	< 100 Mbps	Between 100 Mbps and 1 Gbps	Between 1 and 10 Gbps	Above 10 Gbps
Application	1 x nProbe	2 x nProbes	4-8 x nProbes	Use nProbe Cento
Traffic Capture	None	2 RSS Queues + PF_RING	4-8 RSS Queues + ZC	8 RSS + PF_RING ZC
Flow Export Rate	< 100 FPS	< 1000 FPS	< 3000 FPS	3000+ FPS
Active Flow Cache	Thousands	Hundreds of Thousands	A few Millions	Tenth of Millions
CPU Type	2 cores	2 cores+	4 cores+	8 cores+
Memory	2 GB	2 GB+	4-8 GB+	16 GB+

Note: FPS stands for flows/sec

Flow Collection/Proxy

In flow collection nProbe performance changes according to the number of device exporting to it. In case of large number of flows to be collected, it is advised to load-balance flows across multiple nProbe instances. This by partitioning probe devices across multiple nprobe instances. In flow collection flows are usually saved on disk or dumped on a database, thus adding disk speed into the equation. The expected performance figures - per core / per nProbe instance - range from 50 to 90k FPS when usinf the nProbe cache for merging flows. If you want to bypass the cache (-–collector-passthrough) you can expect to go over over 200k FPS. Here can find a detailed report about nProbe performance

Plugins

Enabling plugins increases requirements based on traffic type. Increase +25% system load enablign plugins such as (but not limited to) DNS, VoIP and email.

Disk

Unless you decide to store data on disk (eg. using -P) no disk space is really necessary to operate nProbe.

Operating System

Even though nprobe supports both Linux, MacOS and Windows, we advise to use Linux for best perfomance.

Multiple nProbe per Host Deployment

If you have more traffic you can scale up by spawning multiple instances (make sure you set core affinity to avoiding nProbe to step on each other toes).